364 matches found
CVE-2018-14924
CVE-2018-14924 affects Matera Banco 1.0.0. The connected sources describe a stored XSS in the application, exploitable via the sca/privilegio/consultarUsuario.jsf “Nome Completo” field. CNVD notes a remote attacker can inject arbitrary script/HTML, consistent with stored XSS. No patch/version rem...
Synology Photo Station elevation of privilege vulnerability (CNVD-2018-11290)
Synology Photo Station is a Synology solution for sharing pictures, videos and blogs over the Internet. A security vulnerability exists in Synology Photo Station versions prior to 6.8.5-3471 and prior to 6.3-2975. A remote attacker can exploit the vulnerability to perform a power lifting attack...
CVE-2018-8926
Permissive regular expression vulnerability in synophotodsmuser in Synology Photo Station before 6.8.5-3471 and before 6.3-2975 allows remote authenticated users to conduct privilege escalation attacks via the fullname parameter...
Privilege escalation
Permissive regular expression vulnerability in synophotodsmuser in Synology Photo Station before 6.8.5-3471 and before 6.3-2975 allows remote authenticated users to conduct privilege escalation attacks via the fullname parameter...
CVE-2017-2642
Moodle 3.x has user fullname disclosure on the user preferences page...
CVE-2017-2642
Moodle 3.x has user fullname disclosure on the user preferences page...
Design/Logic Flaw
Moodle 3.x has user fullname disclosure on the user preferences page...
CVE-2017-2642
Moodle 3.x has user fullname disclosure on the user preferences page...
CVE-2017-2642
CVE-2017-2642 affects Moodle 3.x, causing a user fullname disclosure on the user preferences page. The incident is supported by multiple feeds in connected data, including CVE reporting and OpenVAS/Nessus entries that reference Moodle moodle 3.x and the associated Fedora updates. CVSS metrics ind...
WakaTime: [Privilege Escalation] Authenticated users can manipulate others fullname without their knowledge
Hi Team, Summary I have found a vulnerability, Which is you can change/update others Fullname without there knowledge. Step-by-step Reproduction Instructions 1. login your account https://wakatime.com/login 2. after you login go to Leaderboard then click Create new one or in easy way is to go her...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in Bilboplanet 2.0 allow remote attackers to inject arbitrary web script or HTML via the 1 tribename or 2 tags parameter in a tribes page request to user/ or the 3 userid or 4 fullname parameter to signup.php...
CVE-2014-9916
Multiple cross-site scripting XSS vulnerabilities in Bilboplanet 2.0 allow remote attackers to inject arbitrary web script or HTML via the 1 tribename or 2 tags parameter in a tribes page request to user/ or the 3 userid or 4 fullname parameter to signup.php...
Digital Campus2.0数字校园平台 classpubliccourse.aspx FullName参数SQL注入漏洞
文件：/code/teach/coursecenter/classpubliccourse.aspx 代码： code 区域 private void CheckCourse PublicCourseManager publicCourseManager = new PublicCourseManager; string request = base.GetRequest"paramID"; string request2 = base.GetRequest"FullName"; //过滤不严，下面定义的是Int,字符型注入。 int num =...
Bilboplanet 2.0 - Multiple Cross-Site Scripting Vulnerabilities
Bilboplanet 2.0 - Multiple Cross-Site Scripting Vulnerabilities Exploit Title: Multiple XSS vulnerabilities in Bilboplanet application Date: 10/15/13 Exploit Author:Vivek N http://nvivek.weebly.com/ Vendor Homepage: http://www.bilboplanet.com/ Software Link:...
Envoy: Delete visitor from IPAD with fullname which contains JS results XSS
Hi, Update visitor from IPAD with fullname of alert1 and save. IGNORE THE POP UP, IT HAS BEEN REPORTED ALREADY Delete this user, XSS will pop up, the fullname is now stored XSS. Any visitor which using the IPAD application can create stored XSS which will be activate once you clicked on the delet...
DEBIAN-CVE-2013-4885
The http-domino-enum-passwords.nse script in NMap before 6.40, when domino-enum-passwords.idpath is set, allows remote servers to upload "arbitrarily named" files via a crafted FullName parameter in a response, as demonstrated using directory traversal sequences...
CVE-2013-4885
The http-domino-enum-passwords.nse script in NMap before 6.40, when domino-enum-passwords.idpath is set, allows remote servers to upload "arbitrarily named" files via a crafted FullName parameter in a response, as demonstrated using directory traversal sequences...
CVE-2013-4759
Multiple cross-site scripting XSS vulnerabilities in the Magnolia Form module 1.x before 1.4.7 and 2.x before 2.0.2 for Magnolia CMS allow remote attackers to inject arbitrary web script or HTML via the 1 username, 2 fullname, or 3 email parameter to...
